FlexLM.ECC.Generic.Patcher-Flexlm targets (x86/x64 up to version 11.9.x)

[pharmacist]

Ok I have sent a message with the whole files and another one with the lmgrd.dll, daemon and a protected file of the 32 bit version.

The public key before and after patching (done on v 2013) (the public key can be extracted easily using IDA)
The original and the patched public key
original
.rdata:004E74C0 aBeginPublicKey db '-----BEGIN PUBLIC KEY-----',0Ah
.rdata:004E74C0 ; DATA XREF: sub_4170E0+Co
.rdata:004E74C0 ; sub_417810+122o
.rdata:004E74C0 db 'MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArmmz0 lLeIlyQ94QJMY/H',0Ah
.rdata:004E74C0 db 'sAG/saE2+qb2Ws6DGNYhL24JH95qinUxYf6RKDHqsRq7CqtPY7x6Ha kJgYjYTHi2',0Ah
.rdata:004E74C0 db '+hPd6UbCwBuso4C9gRL27jvOgW5yOrWsMiy/1dN4m81zdRS01VEMA4Vp9xoFRl43',0Ah
.rdata:004E74C0 db '3jXb6T8sBIhcisE/PmjNo+Z6QSI4yAFSoGvpPjrNORU45PEeAFXTTYj3tZqmjjSx', 0Ah
.rdata:004E74C0 db 'LpweaNrTtw84DCBG+sBm7UWHpoi3e1fX7uN3U9xT51Jr3ZgsN qSPryGceB/itSsy',0Ah
.rdata:004E74C0 db 'JImmEgKtZSIkl2+ltSRYWd2/58nnNEz9zyeCe9TBqhBCYpUngHmfgML5mAcLC8Hn',0Ah
.rdata:004E74C0 db 'SQIDAQAB',0Ah
.rdata:004E74C0 db '-----END PUBLIC KEY-----',0




patched
.rdata:004E74C0 aBeginPublicKey db '-----BEGIN PUBLIC KEY-----',0Ah
.rdata:004E74C0 ; DATA XREF: sub_4170E0+Co
.rdata:004E74C0 ; sub_417810+122o
.rdata:004E74C0 aBeginPublicKey db '-----BEGIN PUBLIC KEY-----',0Ah
.rdata:004E74C0 ; DATA XREF: sub_4170E0+Co
.rdata:004E74C0 ; sub_417810+122o
.rdata:004E74C0 db 'MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwsjjO YW4ftmsY9L1t3ek',0Ah
.rdata:004E74C0 db 'eE29ApX5cIHOs+xB1iINsb3iGxBXDhETZMb/Qmj7TyDb0uEnKMyR6ja6Q4/Na4Qv',0Ah
.rdata:004E74C0 db 'xsLbajzk2GXIfPrjEdfUOnNGvsU1ZwNFC7Jsg7k6xQm/O1/Q0l15nvHzFuMmKb/W',0Ah
.rdata:004E74C0 db '33yhtjBTD6unWnkR+KHQjy3psuh9tjBimh7GCDEXPIV9Su5AY/TOPuYdAW+gtVkk',0Ah
.rdata:004E74C0 db 'ws/e76jILnnikx35FqD9UYNLVS8hFqrJh46Uo5JY1m0XFnn4cizIl O2VOcZ7K48f',0Ah
.rdata:004E74C0 db '573nJrTLeNiSSK4o6XI6Uit01g3rETy6IPKyntpv4Vj4/LUT+4Tv7j0dbYDDaiV/',0Ah
.rdata:004E74C0 db 'eQIDAQAB',0Ah
.rdata:004E74C0 db '-----END PUBLIC KEY-----',0

[Aleksej]

... (the public key can be extracted easily using IDA)...

in that case, there is another method to get RSA public key:

$ ./lictest -k
-----BEGIN PUBLIC KEY-----
...blah-blah-blah
-----END PUBLIC KEY-----

[darsy]

Hello Darsy,
I need help if you please in flexlm 11.12 public key patching and lmcrypt generation or publickey verify patching (whichever is possible)
I have sent pm with deamon and a file.
I have some experience in flexlm but this target is really challenging. I can provide any information regarding it

Your target is not 11.12.x.x version

I found in your target files:

FLEXnet Licensing v11.10.0.0 build 95001 i86_n3 (lmgr.lib) - lmgr11.dll

[pharmacist]

Strange I checked the software myself:

http://postimg.org/image/r2f07p94r/
It says that the daemon is 11.12

Whatever it is, can you help me in this generating a lmcrypt by using public/private key pair and patching the public key found in ida

[pharmacist]

in that case, there is another method to get RSA public key:

$ ./lictest -k
-----BEGIN PUBLIC KEY-----
 ...blah-blah-blah
-----END PUBLIC KEY-----

lictest has 3 hidden command line options: -c -k -i

-c means "check", i.e. $ lictest -c -f license_file

-k means "print pubkey"

Can you please tell me where is this tool

[Aleksej]

Strange I checked the software myself: http://postimg.org/image/r2f07p94r/ It says that the daemon is 11.12 Whatever it is, can you help me in this generating a lmcrypt by using public/private key pair and patching the public key found in ida

I guess, lmgr11.dll is just "honey pot" and not used for protection. No one file has linked statically with lmgr11.dll or loaded dinamically this dll

[pharmacist]

Aleksej,
I hope ,if you managed to do it, to post a tutorial regarding how to use your own pubkey to create a lmcrypt (btw sdk 11.9 will work).

[Aleksej]

Can you please tell me where is this tool

C:\*****2014-3\utilities\lictest.exe

[pharmacist]

I got it. it seems you are trying to find a solution for linux version. It is the same by patching the flexlm targets ecc pubkey (the only difference I remember for 2014 is that there is a file called libmmfileshared which has the signature too and should be patched)
What I really need is how to use this an rsa key of your own to get working lmcrypt.

[pharmacist]

Regarding the analysis of the target:
1-U can open lictest.exe and you will see the following functions in IDA
There is subroutin called check_signature which calls another subroutine that read pubkey.
The check_signature subroutine is called by validate_license and mmlic3_verify_signature subroutines.
validate_license is called by mmlic3_feature_exists and mmlic3_set_tokens
check_signature is called by mmlic3_verify_signature
2-what is needed is to get the right response from the subtroutine that reads pubkey.